Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Honda Civics and the Evil Valet

juniperspring.org

Post reply on HN
Print view View original

11–20 of 105 posts

Re: Honda Civics and the Evil Valet

#11

Post by vel0city »

librick wrote: post #2

To update 10th-gen Honda Civics, Honda ships updates on specially-formatted USB drives. They're essentially Android 4.2.2rc1-era recovery packages with some Honda-added version checks (which can be spoofed). The packages are signed with the publicly-known AOSP test key, so with physical access to the front USB port you can sign and flash your own package for arbitrary code execution on the headunit. This doesn't requ…

A number of other cars' infotainment systems are also based on ASOP. I remember downloading updates for my Hyundai which were also essentially Android images

Re: Honda Civics and the Evil Valet

#12

Post by hankbond »

jmalicki wrote: post #8
hankbond wrote: post #7

Seeing more and more projects eschew code docs with the idea that "well architected code can be queried by LLMs" and stick to more functional runbook style docs. It really is unlikely that at any given point all of the docs of a project are up to date with the code. I'm generally aligned with this, but it is predicated on the whole "well architected" code part.

I'd rather see unit tests as documentation. The test can show intended use, show interesting corner cases, and I know it is up to date because it is constantly running and passing. I think that is a huge underrated benefit of adding a lot more testing. If I think a developer is going to ask a question of how something works, or about a corner case, isn't that deserving of a test, so they can just see proof of the ans…

You know what, you are right on the money with that. I think if you expand to include functional/smoke/e2e tests, that covers pretty much everything documentation is supposed to be.

Just by running them you can measure if they are in or out of sync with the code (well, if they were written correctly).

Re: Honda Civics and the Evil Valet

#13

Post by hparadiz »

vel0city wrote: post #11
librick wrote: post #2

To update 10th-gen Honda Civics, Honda ships updates on specially-formatted USB drives. They're essentially Android 4.2.2rc1-era recovery packages with some Honda-added version checks (which can be spoofed). The packages are signed with the publicly-known AOSP test key, so with physical access to the front USB port you can sign and flash your own package for arbitrary code execution on the headunit. This doesn't requ…

A number of other cars' infotainment systems are also based on ASOP. I remember downloading updates for my Hyundai which were also essentially Android images

The head units themselves are very dated and simply could not run recent versions of Android. I have a 2020 and I'm always eyeing up the after market units which are all better in every way.

Re: Honda Civics and the Evil Valet

#14

Post by BobbyTables2 »

I’ve heard product managers proudly proclaim their firmware was signed using the corporate internal signing service (good).

Of course, the question explicitly being asked (related to internal mandate) was if the firmware was signed — not if the firmware update process actually checked the signature (it certainly did not).

Re: Honda Civics and the Evil Valet

#15

Post by hnav »

Wonder how good the rest of the security is. The head unit is likely hooked up to a CAN gateway, can it call into telematics. Maybe find some novel way to abuse carplay/aa to call home.

Re: Honda Civics and the Evil Valet

#16

Post by mschulkind »

BobbyTables2 wrote: post #14

I’ve heard product managers proudly proclaim their firmware was signed using the corporate internal signing service (good). Of course, the question explicitly being asked (related to internal mandate) was if the firmware was signed — not if the firmware update process actually checked the signature (it certainly did not).

I'm surprised someone named BobbyTables2 wouldn't go straight for the proper way to check email PGP signatures...

Re: Honda Civics and the Evil Valet

#18

Post by runjake »

t1234s wrote: post #4

Could you use this to get a version of lineage OS running on it?

You could, but if this unit is anything like it is in my CR-V, and its most likely the same, it's an ancient slow OMAP processor and 4GB of RAM (IIRC).

Edit: Looks like a Tegra 3 in this one, but my bet is meager RAM.

Re: Honda Civics and the Evil Valet

#19

Post by DANmode »

librick wrote: post #2

To update 10th-gen Honda Civics, Honda ships updates on specially-formatted USB drives. They're essentially Android 4.2.2rc1-era recovery packages with some Honda-added version checks (which can be spoofed). The packages are signed with the publicly-known AOSP test key, so with physical access to the front USB port you can sign and flash your own package for arbitrary code execution on the headunit. This doesn't requ…

> AOSP

Android Open Source Project

for those outside the bubble!

Re: Honda Civics and the Evil Valet

#20

Post by naturalmovement »

If I'm reading the room, the sentiment is Honda is incompetent and their cars are security holes on wheels. But if the opposite happened, they would be technofascists locking us out of our own cars, a 30 post sub-thread "this is why I drive a 1999 Ford Ranger" would ensue, and someone would be investigating it as a possible GPL violation. Do I have this right?

It's also a good assumption most people airing such complaints have never eaten in a restaurant fancy enough to have valet parking, let alone evil valets.

That said, are evil valets known to tote around USB drives, or would they more likely use your navigation system to drive back to your empty house and clean it out while you're eating?

Post reply on HN